security: close thumbnail and upload quota bypasses

internal/api/server.go

@@ -849,8 +849,15 @@ func (s *Server) updatetext(w http.ResponseWriter, r *http.Request) {
 	writeCreated(w)
 }
 func (s *Server) upload(w http.ResponseWriter, r *http.Request) {
+	if s.UploadMaxTotalSize > 0 {
+		r.Body = http.MaxBytesReader(w, r.Body, s.UploadMaxTotalSize)
+	}
 	if e := r.ParseMultipartForm(64 << 20); e != nil {
-		http.Error(w, e.Error(), 400)
+		if _, ok := e.(*http.MaxBytesError); ok {
+			http.Error(w, e.Error(), http.StatusRequestEntityTooLarge)
+		} else {
+			http.Error(w, e.Error(), http.StatusBadRequest)
+		}
 		return
 	}
 	a := account(r, s)
@@ -974,6 +981,9 @@ func savePart(st storage.Storage, target string, h *multipart.FileHeader, maxSiz
 }
 
 func (s *Server) upload2(w http.ResponseWriter, r *http.Request) {
+	if s.UploadMaxTotalSize > 0 {
+		r.Body = http.MaxBytesReader(w, r.Body, s.UploadMaxTotalSize)
+	}
 	a := account(r, s)
 	rawDir := r.URL.Query().Get("folder")
 	if unsafePath(rawDir) {
@@ -986,7 +996,11 @@ func (s *Server) upload2(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if err := r.ParseMultipartForm(128 << 20); err != nil {
-		http.Error(w, err.Error(), 400)
+		if _, ok := err.(*http.MaxBytesError); ok {
+			http.Error(w, err.Error(), http.StatusRequestEntityTooLarge)
+		} else {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+		}
 		return
 	}
 	// Preflight the complete multipart batch before creating anything.
@@ -1258,15 +1272,19 @@ func (s *Server) thumbnail(w http.ResponseWriter, r *http.Request) {
 		}
 	})
 	data, err := s.ThumbnailCache.Do(key, func() ([]byte, error) {
-		src, _, err := image.Decode(f)
+		config, _, err := image.DecodeConfig(f)
 		if err != nil {
 			return nil, err
 		}
-		if s.ThumbnailMaxPixels > 0 {
-			b := src.Bounds()
-			if int64(b.Dx())*int64(b.Dy()) > s.ThumbnailMaxPixels {
-				return nil, fmt.Errorf("thumbnail dimensions too large")
-			}
+		if s.ThumbnailMaxPixels > 0 && int64(config.Width)*int64(config.Height) > s.ThumbnailMaxPixels {
+			return nil, fmt.Errorf("thumbnail dimensions too large")
+		}
+		if _, err := f.Seek(0, io.SeekStart); err != nil {
+			return nil, err
+		}
+		src, _, err := image.Decode(f)
+		if err != nil {
+			return nil, err
 		}
 		thumb := transform.Resize(src, 320, 240, transform.Linear)
 		var buf bytes.Buffer